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Abstract 

We introduce a notion of the quantum query complexity of a certificate structure. This is a 
formalisation of a well-known observation that many quantum query algorithms only require the 
knowledge of the disposition of possible certificates in the input string, not the precise values therein. 

Next, we derive a dual formulation of the complexity of a non-adaptive learning graph, and use 
it to show that non-adaptive learning graphs are tight for all certificate structures. By this, we mean 
that there exists a function possessing the certificate structure and such that a learning graph gives 
an optimal quantum query algorithm for it. 

For a special case of certificate structures generated by certificates of bounded size, we construct 
a relatively general class of functions having this property. The construction is based on orthogonal 
arrays, and generalizes the quantum query lower bound for the fc-sum problem derived recently [7]. 

Finally, we use these results to show that the learning graph for the triangle problem from Ref. [20] 
is almost optimal in these settings. This also gives a quantum query lower bound for the triangle-sum 
problem. 

1 Introduction 

Determining the amount of computational resources required to solve a computational problem is one 
of the main problems in theoretical computer science. At the current stage of knowledge, however, this 
task seems far out of reach for many problems. In this case, it is possible to analyse the complexity of 
the problem under some simplifying assumptions. 

One of such assumptions is exhibited by the query model. In this model, it is assumed that all 
computational resources except accessing the input string are free of charge. (For a detailed description 
of the model, including our case of interest — quantum query complexity, refer to [HI].) Under this 
assumption, it is possible to prove some tight bounds. In particular, a relatively simple semidcfinite 
program (SDP) was constructed, yielding a tight estimate for the quantum query complexity of any 
function. This is the adversary bound, we describe in Section [5.1l 

Unfortunately, for many functions, even this SDP is too hard to solve. In this paper, we investigate a 
possibility of constructing an even simpler optimization problem under further simplifying assumptions. 
Our assumptions are motivated by the class of algorithms based on quantum walks. A popular framework 
for the development of such algorithms [22{ includes a black-box checking subroutine that, given the 
information gathered during the walk, signals if this information is enough to accept the input string. 
In many cases, the precise content of the gathered information is not relevant for the implementation of 
the quantum walk, what matters are the possible locations of these pieces of information. We formalise 
this by the following definition. 

In the definition, we use the following notations. If m and n are positive integers, we use [n] to denote 
the set {1, 2, . . . , n}, and [m, n) to denote the set {m, m + 1, . . . , n}. Also, for a sequence x = (xi) £ [q] n 
and S C [n], let x$ €E [q] s denote the projection of x on S, i.e., the sequence (x Sl , . . . ,x Se ) indexed by 
the elements s%,. ..,S£ of S. 

Definition 1 (Certificate Structure). A certificate structure C on n variables is a collection of non-empty 
subsets of 2[™1 with each subset closed under taking supersets. We say a function /: V — > {0, 1} with 
T> C [q] n has certificate structure C if, for every x g / _1 (1), one can find M £ C such that 

VS € M Vz € V: z s = x s => f(z) = 1. 
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We are interested in quantum algorithms performing equally well for any function with a fixed cer- 
tificate structure. Some examples of such algorithms are given in Section [5J More formally, define the 
quantum query complexity of a certificate structure as the maximum quantum query complexity over all 
functions possessing this certificate structure. 

A recently developed computation model of a (non-adaptive) learning graph [5] relies on the certifi- 
cate structure of the function by definition. This suggests to define the learning graph complexity of a 
certificate structure as the minimum complexity of a non-adaptive learning graph computing a function 
(hence, any function) with this certificate structure. Since a learning graph can be transformed into 
a quantum query algorithm with the same complexity, the learning graph complexity of a certificate 
structure is an upper bound on its quantum query complexity. In this paper, we prove that these two 
complexities are actually equal up to a constant factor. 

Theorem 2. For any certificate structure, its quantum query and learning graph complexities differ by 
at most a constant multiplicative factor. 

This means that any quantum query algorithm willing to perform better than the best learning graph 
has to take the values of the variables into account on the earlier stages of the algorithm. Although 
Theorem [5] is a very general result, it is unsatisfactory in the sense that the function having the required 
quantum query complexity is rather artificial, and the size of the alphabet is astronomical. However, 
for a special case of certificates structures we are about to define, it is possible to construct a relatively 
natural problem with a modestly-sized alphabet having high quantum query complexity. 

Definition 3 (Boundcdly Generated Certificate Structure). We say that a certificate structure C is 
boundedly generated if, for any M G C, one can find a subset Am Q [n] such that \Am\ — 0(1), and 
S € M if and only if S 2 A M . 

Definition 4 (Orthogonal Array). Assume T is a subset of [q] k . We say that T is an orthogonal array 
over alphabet [q] iff, for every index i £ [k] and for every sequence a?i, . . . , Xj_i, Xj+i, ■ ■ • , xu of elements 
in [q], there exist exactly |T|/<7 fc_1 choices of Xi £ [q] such that (xi, . . . ,Xk) € T. We call \T\ the size 
of the array, and k — its length. (Compared to a standard definition of orthogonal arrays (cf. |16p. we 
always require that the so-called strength of the array equals k — 1.) 

Theorem 5. Assume a certificate structure C is boundedly generated, and let Am be like in Definition^ 
Assume the alphabet is [q] for some q > 2\C\, and each Am is equipped with an orthogonal array Tm over 
alphabet [q] of length \Am\ and size q\ Au \~~ 1 . Consider a function f: [q] n — > {0, 1} defined by f(x) — 1 iff 
there exists M 6C such that Xa m € Tm- Then, the quantum query complexity of f is at least a constant 
times the learning graph complexity of C 

For example, for a boundedly generated certificate structure C, one can define the corresponding sum 
problem: Given x € [q] n , detect whether there exists M G C such that J2j<£A M x i = ^ ( m °d <?)■ If 
q > 2\C\, Theorem [5] implies that the quantum query complexity of this problem is at least a constant 
times the learning graph complexity of C . 

Theorem [5] is a generalization of the lower bound for the fc-sum problem from Ref. [7j , and provides 
additional intuition on the construction, by linking it to learning graphs. Much of the discussion in 
Ref. [7] applies here as well. 

Let us briefly comment on organization of the paper. In Section[2J we give some examples of certificate 
structures, inspired by known computational problems. In Section^ we derive a dual formulation of the 
complexity of a non-adaptive learning graph. In Sectional we apply this dual formulation to give lower 
bounds on the learning graph complexity of the certificate structures from Section [2] We demonstrate 
that transition to the learning graph complexity indeed simplifies the problem by obtaining an almost 
optimal Jl(n 9 / 7 ) lower bound for the triangle certificate structure, whereas nothing better than trivial 
f2(n) is known for the original triangle problem. Finally, in Section [51 we prove both Theorem [5] and [SJ 

2 Examples of Certificate Structures 

We defined the certificate structure notion in the introduction. Actually, many existing quantum algo- 
rithms, implicitly or explicitly, work in these settings. In this section, we recall some of these algorithms 
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and define the corresponding certificate structures. In Section 31 we consider their learning graph com- 
plexities. 

The most celebrated examples of such algorithms are demonstrated by Grover's search algorithm j!5j . 
and Ambainis' algorithm for element distinctness and ^-distinctness [3]. As first noticed by Childs and 
Eisenberg Ambainis' algorithm can be applied for finding any subset of size k. In other words, it 
works for any function having the following certificate structure: 

Definition 6. The k-subset certificate structure C on n elements with k = 0(1) is defined as follows. It 
has (?) elements, and, for each subset A C [n] of size k, there exists unique M £ C such that S £ M if 
and only if A C S C [n]. 

In the same paper, Childs and Eisenberg conjectured that Ambainis' algorithm is optimal for the 
fc-sum problem. Theorem [5] can be seen as a strong generalization of this conjecture (as Ambainis' 
algorithm can be implemented as a learning graph). 

Another well-known quantum-walk-based algorithm |23j (implicitly) solves any function with the 
following certificate structure: 

Definition 7. The triangle certificate structure C on n vertices is a certificate structure on (™) variables 
defined as follows. Assume that the variables are labelled as xtj where 1 < i < j < n. The certificate 
structure has Q) elements, and, for every triple l<a<b<c<n, there exists unique M £ C such 
that S £ M if and only if S 3 {ab,bc,ac}. (Note that, for this certificate structure, the letter n, that 
customary denotes the number of input variables, is used to denote the number of vertices. This is a 
standard notation, and we hope it will not cause much confusion.) 

Originally, the algorithm in Ref. }23| dealt with the triangle problem: All Xij are Boolean, and the 
condition on f(x) — 1 is that x a b = x ac — Xbc = 1 for some M . The quantum walk algorithm for this 
certificate structure was lately superseded by an algorithm based on learning graphs [20]. We will show 
in Section [4] that this learning graph is esentially optimal. 

Both £;-subset and triangle certificate structures are boundedly generated. We also consider some 
examples of certificate structures that are not. Recall the collision problem [9]. Given an input string 
x £ [q] 2n , the task is to distinguish two cases. In the negative case, all input variables are distinct. In the 
positive case, there exists a decomposition of the input variables [2n] = {a\, i>i} U {02, 62} U ■ • • U {a n , b n } 
into n pairs such that x ai = x^ for all i £ [n], but x ai 7^ x aj for all i ^ j. The set equality problem is 
defined similarly, with an additional promise that, in the positive case, £ [n] and bi £ [n + 1, 2n] for 
all i. Finally, the hidden shift problem is defined like the set equality problem with an additional promise 
that, in the positive case, there exists d £ [n] such that fe; = n + 1 + ((a; + d) mod n) for all i £ [n]. 
Inspired by these problems, we define the following certificate structures. 

Definition 8. Each of the following certificate structures is defined on 2n input variables. In the collision 
certificate structure, there is unique M for each decomposition [2n] — {cii, 61} U {ci2, 62} U • • • U {a n , b n }, 
and S £ M if and only if S 3 {ai,bi} for some i £ [n]. The set equality certificate structure contains 
only those M from the collision certificate structure that correspond to decompositions with a,; £ [n] 
and bi £ [n + l,27i] for all i. Finally, the hidden shift certificate structure contains only those M from 
the set equality certificate structure that correspond to decompositions such that d £ [n] exists with the 
property bi = n + 1 + ((aj + d) mod n) for all i £ [n]. 

All certificates structure from Definition [5] are not boundedly generated. The algorithm for the 
collision problem from Ref. [5] actually solves any function possessing the collision certificate structure 
in (^(n 1 / 3 ) quantum queries, and it is tight pQ. Clearly, the same algorithm is applicable for the set 
equality and hidden shift certificate structures. The situation with the hidden shift problem is more 
interesting. This problem reduces to the hidden subgroup problem in the dihedral group [18] , and the 
latter has logarithmic query complexity [12]. Unlike other algorithms in this section, the latter one is 
not, in general, applicable to any function with the hidden shift certificate structure. 

3 Learning Graph Complexity 

In this section, we recall the definition of a non-adaptive learning graph from Ref. and derive its 
dual formulation. Although more general concepts of learning graphs were introduced [51 31 [T3], the 
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non-adaptive version was used extensively [551 HH1 HO]) mostly because of its simplicity. Hence, it is 
important to understand its limitations. 

Let £ by the set of pairs (S, S') of subsets of [n] such that S' = S U {j} for some j ^ S. This set 
is known as the set of arcs of a learning graph on n variables. For e = (S, S') G £, let s(e) = S and 
t(e) = S>. 

Definition 9. The learning graph complexity of a certificate structure Conn variables is equal to the 
optimal value of the following two optimization problems 



minimize 



E ee£ ^ ( la ) 



subject to V < i f or a n M G C; (lb) 

Pe(M) = ^2 p e (M) for all M G C and S G 2^ \ (M U {0}); (lc) 

e££: t(e)=S e6£: s(e)=S 

V o e (M) = l for all MeC; (Id) 

t-^eEt : s(e)=0 

p e (M)GM, w e > for all e G £ and M G C; (le) 

(here, 0/0 in (|lb|) is defined to be 0), and 



maximize * ' c a 0(^) 2 (^ a ) 

subject to E M c ( as ( e )( M ) _ «t(e)(^)) 2 < 1 for all e G £; (2b) 
a s (M) = whenever 5 G M; (2c) 

a s (M) G R for all 5 C [n] and M G C. (2d) 

Eq. ((T|) is a restatement of the definition of a non-adaptive learning graph from Ref. [5] . (In Ref. [5] , 
the complexity was defined as the minimum of (jlap and the maximum of the left hand side of (jlbl) over 
all M . The current formulation can be obtained by rescaling all p e (M) by the same factor. See also 
Footnote 1 in Ref. [3].) The second expression @ is a new one, and requires a proof. 

Proof of the equivalence of 0) and (TJ|). The equivalence is obtained by duality. We use basic convex 
duality [HI Chapter 5]. First of all, we consider both programs with their objective values (fTa)) and (|2"aj) 
squared. With this change, Eq. ([!} becomes a convex program (for the convexity of (jlbp . see Ref. [SI 
Section 3.1.5]). The program is strictly feasible. Indeed, it is easy to see that (Tic)) and (|ld[) are feasible. 
To assure strong feasibility in (|lbp. it is enough to take w e large enough. Hence, by Slater's condition, 
the optimal values of (flj and its dual are equal. Let us calculate the dual. The Lagrangian of ([1]) is as 
follows 



eeS MeC \ee£ 



E E peW- E p*( M n + E "mA 1 - E p-w)- 

AfeC, SC[n] V eG£ eG£ / MeC V eG£ / 

S#0, S£M t(e)=S a(e)=S s(e)=0 



(3) 



Here fiM > 0, and j^a/.s are arbitrary. Let us first minimize over p e (M). Each p e (M) appears three 
times in ([3]) with the following coefficients: 

p e (M) 2 — +p e (M)(l' MMe) - V M ,a{e)), 

where we assume vm,s — for all S G M. The minimum of this expression clearly is 

We / \2 
\ v M,t{e) — v M,s{e)j ■ 



4/iM 
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Plugging this into §5$ yields 



(^m,0 ~ MA/) +L™ e 1-L iTTT ■ ( 4 ) 

Mec ees \ Mec ^ M ) 



Define ag{M) as vm,s/ i^y/lHf) ■ Minimizing Q over w e , the second term disappears if condition ([2b 
is satisfied. The first term is 

^2 (2v^7a (M) -fi M )- 
Mec 



We can also maximize over /im, that gives the square of (|2a[). □ 

We have the following result: 

Theorem 10 ([3 |6]). XTie quantum query complexity of a certificate structure is at most a constant 
times its learning graph complexity. 

In Section O we prove the reverse statement for all certificate structures. 

4 Examples of Application 

In this section, we construct feasible solutions to the dual formulation of the learning graph complexity ([2]) 
for the certificate structures from Section [5] Their objective values match the objective values of feasible 
solutions to the corresponding primal formulations (JT|) that were obtained previously. 

Proposition 11. The learning graph complexity (and, hence, the quantum query complexity) of the 
k-subset certificate structure is n(n k ^ k+1 ^). 

Proof. Let C be the fc-subset certificate structure. Define as(M) as 

-1/2 



;{„*/(*+!) -IS], 0} 



if S M, and as otherwise. 

Let us prove that (|2bl) holds up to a constant factor. Take any S C [n] and let j be any element 
not in S. If |5| > n k ^ k+1 \ then ag(M) = otsu{j}{M) = and we are done. Thus, we further assume 

\S\ < n fc /( fc +!). There are (£) choices of M. If SU{j} <£ M, then the value of a s (M) changes by G!)~ 1/2 
as the size of \S\ increases by 1. Also, there are at most (if]) < ^Mfe- 1 )/^ 1 ) choices ofMeC such that 

S £ M and S U {j} G M. For each of them, the value of cts{M) changes by at most (™) 1 ^ 2 n k ^ k+1 \ 
Thus, 



1 r 

n ' 



• 1 +n Hk-l)/(k+l) n 2k/(k+l) 



MeC 

On the other hand, for the objective value (|2"aj) . we have 



0(1). 



/^a (M)2 = n fc A fc+1 ). □ 
y Mec 

Ref. [6j [26] show that the corresponding upper bound is 0(n k ^ k+1 ), thus the result of Proposition [Til 
is tight. Moreover, Theorem [S] implies that the complexity of the A:-sum problem is Q(n k ' ( fe + 1 )), a result 
previously proven in [7] . 

Proposition 12. The learning graph complexity of the hidden shift (and, hence, the set equality and the 
collision) certificate structure is ^(n 1 / 3 ). 
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Proof. The proof is similar to the proof of Proposition [TT] Let C be the hidden shift certificate structure. 
Define cxm(S) as n -1 / 2 max{n 1 / 3 - |5|,0} if S £ M, and as otherwise. Take any S C [n], j ^ S, and 
let us prove (|2b|) . Again, if |5| > n 1 / 3 , we are done. Otherwise, there are n choices of M in total, and 
at most n 1 / 3 of them are such that S £ M and S U {j} e M. Thus, 

£ (a s (M) - a su{j} (M)) 2 < - [n • 1 + n^n 3 / 3 ] = 0(1). 

The objective value (l2a|) is n 1 / 3 . For the set equality and collision certificate structures, just assign 
as(M) = for all M that are not in the hidden shift certificate structure. □ 

The result of this proposition is also tight. The corresponding upper bound can be derived by similar 
methods as used for the £;-sum problem in Ref. [B] 126] . We omit the precise construction. 

Proposition 13. The learning graph (and, hence, the quantum query) complexity of the triangle certifi- 
cate structure is fl(n 9 / 7 j yTogn) . 

The best known upper bound is 0(n 9 / 7 ) as proven in Ref. |20) . The proof of the lower bound is rather 
bulky, and essentially proceeds by showing, in a formal way, that all possible strategies of constructing 
the upper bound fail. 

Proof of Provosition \7M Let E = {uv | 1 < u < v < n} be the set of input variables (potential edges of 
the graph). Let C be the triangle certificate structure. We will construct a feasible solution to © (with 
[n] replaced by E) in the form 

^ U a x{n-^-n-^\S\-Eti9i(S,M), 0}, S $ M; 

10, otherwise; 

where gi(S,M) is a non-negative function such that gi($,M) = and gt(S,M) < n~ 3 / 14 . The value 

of (|2"a|) is yj (3) rt -3 / 14 = f2(n 9 / 7 ). The hard part is to show that (|2b[) holds up to logarithmic factors. 

It is easy to see that as(M) — if \S\ > n 9 ^ 7 , hence, we will further assume |5| < n 9 / 7 . 

For S C E and j € E\S, let F{S,j) denote the subset of M € C such that S <£ M, but SU{j} € M. 
We decompose F(S,j) = Fi(S,j) U • • • U Fk(S,j) as follows. Each M € C is defined by three vertices 
a, b, c forming the triangle: S G M if and only if ab, ac, be € S. An input index j G E satisfies S (f: M 
and Si){j} G M only if j € {a6,ac,6c}. We specify to which of Fi(S,j) an element M £ F(S,j) belongs 
by the following properties: 

• to which of the three possible edges, ab, ac or be, the new edge j is equal, and 

• the range to which the degree in S of the third vertex of the triangle belongs: [0, n 3 / 7 ], [n 3 / 7 , 2n 3 / 7 ], 
[2n 3 / 7 ,4n 3 / 7 ], [An 3 / 7 ,8n 3 / 7 } . . . 

Hence, k ss 12/71og 2 n. For notational convenience, let j = be. Then, the second property is determined 
by deg a = deg s a, the degree of a in the graph with edge set S. 

For i <E [k], we will define gt(S, M) so that, for all S C E of size at most r?l 7 and j G E\ S: 

J2 (gi(S,M)- 9i (SU{j},M)f =0(1) (6) 

MeC\F(S,j) 

and 

£ (n- 3 / 14 -. 94 (5,Af)) 2 ^0(l). (7) 

Let go(S,M) = n- 3 / 2 |5|, for which © holds. Even more, we will show that the set K = K(S,j) of 
i G [0, k] such that ([S]) is non-zero has size O(l). Thus, for the left hand side of (|2b[) . we will have 

^(a s (Af)~a Sum (M)) 2 <|K|^ ^ ( 9i (S, M) ~ 9i (S U {j}, M)f 

MGC i€K MeC\F(S,j) 

+E E (-- 3/14 -^(5,m)) 2 , 

i=l M£F z (S,j) 



G 



where the former term on the right hand size is 0(1) and the latter one is O(logn). By scaling all 
as(M) down by a factor of 0(^/logn), we obtain a feasible solution to © with the objective value 
fi(n 9 / 7 /VIoi^). 

It remains to construct the functions gi(S,M). In the following, let ^(x) be the median of 0, x, and 
1, i.e., n(x) — max{0, min{x, 1}}. The first interval of dega will be considered separately from the rest. 

First interval Assume the condition dega < r?! 1 . Define 

9i(S,M) = 




n 3 / 7 dega), ab,ac<ES; 

otherwise. 



(8) 



Clearly, <?j(0, M) — and gi{S, M) > 0. There are two cases how gi(S, M) may be influenced. We show 
that the total contribution to © is 0(1). 

• It may happen if \{ab, ac} n S\ = 1 and j £ {ab, ac}, i.e., the transition from the second case of (j^J 
to the first one happens. Moreover, gi(S,M) changes only if dega < 2n 3 / 7 . Then j identifies 
two vertices of the triangle, and the third one is among the neighbours of an endpoint of j having 
degree at most 2n 3 / 7 . Thus, the total number of M satisfying this scenario is at most 4n 3//7 . The 
contribution to © is at most 0(n 3/7 )(n~ 3/14 ) 2 = 0(1). 

• Another possibility is that ab, ac <E S and deg a changes. In this case, a is determined as an endpoint 
of j, and 6 and c are among its at most 2n 3 / 7 neighbours. The number of M influenced is 0(n 6 / 7 ), 
and the contribution is 0(n 6 / 7 )(n~ 9 / 14 ) 2 = o(l). 

Finally, we have to show that (J7J holds. If M satisfies the condition, then ab, ac € S and dega < n 3 / 7 . 
In this case, the left hand side of (J7J is 0. 

Other intervals Now assume the condition d < dega < 2d with d > n 3 / 7 . Define a piece- wise linear 
function r as follows 



t(x) = < 



'o, 




x < d/2; 


(2a; - 


d)/d, 


d/2 < x < d; 


< 1, 




d < x < 2d; 


(5d- 


2x)/d, 


2d<x< 5d/2; 






x > 5d/2. 







,t{x) 









d/2 



2d 5d/2 x 



It can be interpreted as a continuous version of the indicator function that a vertex has a right degree. 
Define 

u(S,M)= T ( de g«)' 

v£N(b)nN(c) 

where the sum is over the common neighbours of b and c. Let 



i(S,M) =n- 3/14 /z(mm j 



2 deg a v{S,M) 
d ' n 3 / 7 



- 1 



Let us consider how gi(S,M) may change and how this contributes to (|2b[) . Now there are three cases 
how gi(S,M) may be influenced. We again show that the total contribution to ^ is O(l). 

• It may happen that j is incident to a common neighbour of b and c, and thus v(S) may change. 
This means b and c are among the neighbours of an endpoint of j of degree at most 5d/2. Hence, 
this affects 0(nd 2 ) different M. The contribution is 0(nd 2 )(n~ 9 / 14 /d) 2 = o(l). 

• The set N(b) D N(c) may increase. This causes a change in gi(S,M) only under the following 
circumstances. The new edge j is incident to b or c. The second vertex in {b,c} is among O(d) 
neighbours of the second end-point of j. Finally, deg a > d/2, that together with \S\ < n 9 / 7 implies 
that there are 0(n 9 / 7 /d) choices for a. Altogether, the number of M affected by this is 0(n 9 / 7 ), 
and the change in gt(S, M) does not exceed n~ 9 / 14 . The contribution is O(l). 
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• The degree of a may change. Let us calculate the number P of possible pairs b and c affected 
by this. There is a change in Qi(S,M) only if b and c are connected to at least n 3 / 7 vertices of 
degrees between d/2 and 5d/2. Denote the set of these vertices by A. Since IS"! < n 9 / 7 , we have 
\A\ = 0(n 9 / J /d). 

Let us calculate the number of paths of length 2 in S having the middle vertex in A. On one hand, 
this number is at least Pn 3 ! 7 . On the other hand, it is at most 0(d 2 \A\) = 0(dn 9 ^ 7 ). Thus, P = 
0{dn & / 7 ). Since a is determined as an end-point of j, the contribution is 0(dn 6 / 7 )(n 3 / 14 /d) 2 = 
0(1), as d > n 3 ' 7 . 

Finally, j may be the last edge of the triangle. We know that deg a > d, hence, either n~ 3 / 14 — 
gi(S, M) = 0, or v(S, M) < 2n 3 l 7 , in which case, there are 0(n 3 / 7 ) choices of a satisfying the condition. 
Hence, the left hand side of Jjj is 0(n 3 / 7 ){ n - 3 / 14 ) 2 = 0(1). 

If Qi{S, M) — gi(SU {j}, M) 7^ 0, then, in the first three cases, the value of d, up to a small ambiguity, 
may be determined from the degree of one of the end-points of j. Hence, the set K = K(S,j), as stated 
previously in the proof, exists. □ 

Automatically, we obtain that the quantum query complexity of the triangle sum problem is £1 (n 9 / 7 ). 
Thus, any quantum query algorithm, willing to improve the 0(n 9 / 7 ) bound for the triangle detection 
problem, will have to take differences between the triangle detection and triangle sum problems into 
consideration. 



5 Lower Bound 

In this section, we prove Theorems [2] and \b\ The results are strongly connected: In the second one 
we prove a stronger statement from stronger premisses. As a consequence, the proofs also have many 
common elements. 

This section is organized as follows. In Section 15.11 we recall the adversary method that we use to 
prove the lower bound. In the proofs, we will define a number of matrices and argue about their spectral 
properties. For convenience, we describe the main parameters of the matrices, such as the labelling of 
their rows and columns, as well as their mutual relationships in one place, Section [5. 2 1 In Section [5.31 we 
state the intermediate results important to both Theorems [5] and [5] In Section I5~1I we finish the proof of 
Theorem [5] In Section 15.51 we recall the definition and main properties of the Fourier basis, and define 
the important notion of the Fourier bias. Finally, in Section [5.61 we prove Theorem [5] 



5.1 Adversary Bound 

The adversary method is one of the main techniques for proving lower bounds on quantum query com- 
plexity. First developed by Ambainis [2], it was later strengthened by H0yer et al. [T7J. After that, the 
adversary bound was proven to be optimal by Reichardt et al. 24. 21 . In this paper, we use a variation 
of the adversary bound from Ref. [7J . 

Definition 14. Let / be a function / : T> — > {0, 1} with domain V C [q] n . Let V be a set of pairs (x,a) 
with the property that the first element of each pair belongs to T>, and T>i — {(x,a) £ T> \ f(x) — i} for 
i G {0, 1}. An adversary matrix for the function / is a non-zero real T>\ x 2?o matrix T. And, for j G [n], 
let Aj denote the T>i x T>q matrix defined by 



Ajl(x,a), (y,i 



otherwise. 



Theorem 15 (Adversary bound [171 17]). In the notations of Definition ] 14\ the quantum query complexity 
of f is fi(Adv ± (/)) ; where 

Adv ± (/) = sup B (9) 

r max ie „ ||T o AjU 

with the maximization over all adversary matrices for f, and \\-\\ is the spectral norm. 

The following result is very useful when proving lower bounds using the adversary method . 
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Lemma 16 f |21j). Let Aj be as in Definitional^ Then, for any matrix A of the same size, 

||AoA i ||<2||A||. 

We will use it to replace T o Aj in the denominator of ^ with a matrix V such that T o Aj = V o Aj . 
By Lemma [T6l this gives the same result up to a factor of 2. We will denote this relation between 

matrices by T i — > T . 
5.2 Outline 

Let us briefly outline how Theorems [5] and [3] are proven. Let C denote the certificate structure. Let 
as(M) satisfy ©, and be such that (|2"a)) equals the learning graph complexity of C. We define an 
explicit function /: T> — > {0, 1} with T> C [q] n having the objective value (l2al) of program ([2]) as a lower 
bound on its quantum query complexity. The latter is proven using the adversary bound, Theorem 1151 
For that, we define a number of matrices, as illustrated in Figure [TJ 




Figure 1: The relationships between matrices used in Section [5] The parts marked in grey form the 
matrix V on the left, and V on the right. Note that they are not submatrices of T and T', respectively: 
They have additional multiplicative factor as specified in (fLT| and (fT5|) . 



Matrix T At first, wc construct a matrix T satisfying the following properties. Firstly, it has rows 
labelled by the elements of [q] n x C, and columns labelled by the elements of [q] n . Thus, if we denote 
C = {Mi, . . . , Mfc}, the matrix T has the following form 



r = 



Gm 2 



(10) 



-matrix. Next, 



\GM k / 

r|| is at least the objective value (|2"a|) . And finally, for 
r' and ||r'|| < 1. The matrix V has a decomposition into 



where each Gm is an [q] n x [q] 
each j £ [n], there exists I" such that T 
blocks G' M similar to (jTUJ) . 

Thus, r has a good value of @. But, wc cannot use it, because it is not an adversary matrix: It uses 
all possible inputs as labels of both rows and columns. However, due to the specific way T is constructed, 
we will be able to transform V into a true adversary matrix T such that the value of © is still good. 
Before we describe how we do it, let us outline the definition of the function /. 
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Defining the function Let M be an element of the certificate structure C. Let A M ^ , . . . , A M ^ be all 
the inclusion-wise minimal elements of M . (In a boundedly generated certificate structure, M has only 
one inclusion- wise minimal element Am-) For each A^, we choose an orthogonal array T M ^ of length 
\A$\ over the alphabet [q], and define 

X M = {xe [<?]" | x A m G 7$ for all i G [f(M)]} . (11) 

The orthogonal arrays are chosen so that Xm is non-empty and satisfies the following orthogonality 
property: 

\JSe2^\M Vze{q} S : \{x€X M \xs = z}\ = \X M \/qW. (12) 

For boundedly generated certificate structures, this property is satisfied automatically. 

The set of positive inputs is defined by / _1 (1) = UmgC The set of negative inputs is defined by 

f-\0) = {i£ [q] n I x aW i T$ for all M G C and i £ [£(M)}\ . (13) 

It is easy to see that / has C as its certificate structure. The parameters will be chosen so that |/ -1 (0)| = 

n( q n ). 

Remaining matrices Let us define X = {(x, M) e [q] n x C \ x £ Xm} and Y — / _1 (0). The matrix 
F is an X x Y matrix defined by 



r[{x,M),y] = ilj±-rl(x,M),v\. (14) 



Thus, T consists of blocks Gm, like in (TTUl) . where Gm = \J q n /\Xm\ Gm\Xm, YJ. (The latter notation 
stands for the submatrix formed by the specified rows and columns). We also show that ||r|| is not much 
smaller than ||L|| . 

The matrix L' is obtained similarly from L'. It is clear that T i — 4 T' implies T i — 4 V. We show that 
the norm of T' is small by showing that ||L'|| = 0(||F'||) where F' is an X x [q] "-matrix with 

T'l(x,M),yj = J^-f'{{x,M),y\. 

As r' is a submatrix of T' and ||r'|| < 1, we obtain that ||r'|| = 0{1) as required. We denote the blocks 
off' by G' M - That is, 

G' M = S^G' M {X M M n l (15) 
5.3 Common Parts of the Proofs 

Let eo, . . . , e q -i be an orthonormal basis of <C q such that eo = 1/ \/q(l, • •->!)• Denote £?o = eoeg and 
i?i = X)i>o e « e i ■ These are g x q matrices. All entries of Eq are equal to 1/q, and the entries of E\ are 
given by 

E^yi = \ 1 :' /q > x z m ^) 

For a subset S C [n], let -Eg denote ® Jg [„] ^ S:j where Sj = 1 if j G <S, and Sj = otherwise. These 
matrices are orthogonal projectors: 

= <[ £s ' 5 = 5 ' (17) 
I 0, otherwise. 

We define the matrices Gm from (fT0| by 

G M = a s{M)E s , (18) 

SC[n] 

where cts(M) are as in @. 
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Lemma 17. IfT and T are defined as in Section \5. 6 A all Xm satisfy the orthogonality property ilty) and 
\Y\ = fl{q n ), then 



i r n = °(jE c a 0( M ) 2 )- 



(19) 



Proof. Recall that G M = y/q n I\X m \Gm{Xm,Y\, hence, by (QI 



Gm = y « (M)^ n [XM,r] + J2as(M)EslX M ,Y}. 

Let us calculate the sum s(Gm) of the entries of Gm- In the first term, each entry of E® n equals q~ n . 
There are \Xm\ rows and |V| columns in the matrix, hence, the sum of the entries of the first term is 
y/\X M \/q" \Y\a (M). 

We claim that, in the second term, s (a s (M)E s lX M , Yj) = for all 5^0. Indeed, if S £ M, then 
a s {M) = by (gc]). Otherwise, 

s{e s \x m ,y]) = y. E £ S M = <z |s| - n E < s \*s,vsi = ^Y. E < |s| i^toi = o. 

yerxeXA/ y eY xex M q y eY z e[ q ] s 

(On the third step, the orthogonality condition (TT21 is used. On the last step, we use that the sum of 
the entries of every column of Ef k is zero if k > 0.) Summing up, 



s(G M ) = y^ \Y\a $ {M). 
We are now ready to estimate ||r||. Define two unit vectors u £ E x and v £ M Y by 
ul(x,M)] = -= " 0(M) == = and %] = ' 



for all (x, M) € X and y £ Y. Then, 

llrll > u*Tv = -J **'* WKGm) = „ fllll .U)-' = <2| > □ 



/J ^£ae(M)' = fi( ,/E«0( M ) 2 



In the remaining part of this section, we define the transformation T i — 4 T' and state some of the 
properties of T' that will be used in the subsequent sections. Using we can define the action of A 
on Eq and E\ by 

E £ and B a A -£ . 

We define V by applying this transformation to Eq and E\ in the jth position in the tensor product 
of (TTg|) . The result is again a matrix of the form (ITU1) . but with each Gm replaced by 

G'm = E Ps{M)E s , (20) 

SC[n] 

where /3g(M) = a s {M) - a Su{i} (Af). In particular, /3 S (M) = if j £ S or 5 £ M. Thus, 

(f')*r' = (G'mTG'm = E (E ^(M) 2 )^. (21) 

AleC SG2H MGC 

In particular, we obtain from (|2b[) that ||r'|| < 1. 
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5.4 Boundedly generated certificate structures 

In this section, we finish the proof of Theorem [5] In the settings of the theorem, the orthogonal arrays 
I'm m CD are a l rea dy specified. Since each M G C has only one inclusion- wise minimal element Am, 
we drop all upper indices (i) in this section. 

From the statement of the theorem, we have \Xm\ — ? n , in particular, they are non-empty. Also, 
Xm satisfy the orthogonality property ([T2l . and, by ([T^]) . we have 



in = 



[q] n \ (J X M > q n - J2 \Xm\ = q n - |C|<f ~ x > \. (22 



MeC Mec 



Thus, the conditions of Lemma IT71 are satisfied, and (|19p holds. 

Recall from Section 15721 that in order to estimate ||r'|| we consider the matrix V. The matrix V is a 
submatrix of T', hence, it suffices to estimate ||r'||. Let k — maxMeC \Am\- By Definition [31 k = 0(1). 

Fix an arbitrary order of the elements in each Am — {«m,i, • • • , &m,\Am\}> an d let I>m,i, where M G C 
and i G [k], be subsets of 2^ satisfying the following properties: 

• for each M, the set 2^ \ M is the disjoint union Lm,i U • • • U LmX- 

• for each M and each i < \Am\, all elements of Lm,% omit au,i', 

• for each M and each i such that \Am\ < i < k, the set Lm,i is empty. 

Recall that, if S C [n] and (sj) is the corresponding characteristic vector, E$ = ®je[ n ] -E^.. The main 
idea behind defining Lm,iS is as follows. 



Claim 18. If S,S' G ijvf.i, *Aen 

(S S [^M,M n ])*(i?5'[^A/, [<?]"]) 



0, otherwise. 



Proof. If we strike out the <ZM,ith element in all elements of Xm, we obtain by the definition of 

an orthogonal array. All elements of Lm,i omit a,M,i, hence, Es has Eq in the aM.ith position for all 
S G IiM,i- Thus, the OM.jth entries of x and ?/ has no impact on the value of Es\x, y\. 
Let (sj) and (s'j) be the characteristic vectors of S and S'. Then, 



E s [x M ,[q] n l = ( Q9 e s 

(Here is on the dM,ith element of [<?]".) Similarly for 5", and the claim follows from (jTT)) . □ 
For each M, decompose G' M from (j2"01) into J~J ie nu G Mi , where 

G' M ,i= E Ps{M)Eg- 

Define similarly to Section l5?2l 



Gi,,, = Jt^-t G'mMm, [«]"] = E &(M)%[Im, M n ], 

and let be the matrix consisting of G' Mi , for all M G C, stacked one on another like in (fTO)) . Then, 
r' = E ieW ^- We have 

(f0*rj = E {G'm^g'm^ -EE /W) 2 £ 5 , 

M<=C MeCS£L M ,i 

by Claim H51 Similarly to (|2Tj). we get ||f<|| < 1. By the triangle inequality, ||f'|| < fc, hence, ||r'|| < 
k = 0(1). Combining this with ([T§]) . and using Theorem [T51 we obtain the necessary lower bound. This 
finishes the proof of Theorem [5j 
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5.5 Fourier Basis 



In Section [5.3l we denned e, as an arbitrary orthonormal basis satisfying the requirement that eo has all 
its entries equal to l/^/q. In the next section, we will specify a concrete choice for e^. Its construction 
is based on the Fourier basis we briefly review in this section. 

Let p be a positive integer, and Z p be the cyclic group of order p, formed by the integers modulo p. 
Consider the complex vector space C Zp . The vectors (Xa)a6Z p , defined by Xa\b\ — e 27nafc / p / v /p, form its 
orthonormal basis. Note that the value of Xa{b} is well-defined because e 2m = 1. 

If U C Z p , then the Fourier bias [25] of U is defined by 



Ml»=- 
P 



max > e 27r ' mu / p 



(23) 



It is a real number between and \U\/p. In the next section, we will need the following result stating 
the existence of sets with small Fourier bias and arbitrary density. 

Theorem 19. For any real < S < 1, it is possible to construct U C Z g such that \U\ ~ Sq, \\U\\ U — 
0(polylog(q)/ v /q) and q is arbitrary large. In particular, \\U\\ U = o(l). 

For instance, one may prove a random subset satisfies these properties with high probability |25l 
Lemma 4.16]. There also exist explicit constructions |14) . 



5.6 General Certificate Structures 

In this section, we finish the proof of Theorem [2] There are two main reasons why it is not possible to 
prove a general result like Theorem [5] for arbitrary certificate structures. 

A first counterexample is given by Proposition Q2] stating that the learning graph complexity of the 
hidden shift certificate structure is f^n 1 / 3 ) and the statement at the end of Section [2] that the quantum 
query complexity of the hidden shift problem is O(logn). The proof in Section 15.41 cannot be applied 
here, because k in the decomposition of G' M into X^te[fe] ^Mi would not be bounded by a constant. We 

solve this by considering much "thicker" orthogonal arrays TjJ . 

Next, the orthogonality property ([12"]) is not satisfied automatically for general certificate structures. 
For instance, assume A$ — {1, 2}, A$ — {2, 3}, and the orthogonal arrays are given by the conditions 
x\ = X2 and X2 — £3, respectively. Then, for any input x satisfying both conditions, we have x\ — £3, 
and the orthogonality condition fails for S — {1, 3}. 

The problem in the last example is that the orthogonal arrays are not independent because A$ and 
A$ intersect. We cannot avoid that A^ls intersect, but we still can have T^s independent by defining 
them on independent parts of the input alphabet. 

More formally, let t = maxA/ec where £(M) is defined in Section l5~2l as the number of inclusion- 

wise minimal elements of M. We define the input alphabet as Z = lf p for some p to be defined later. 
Hence, the size of the alphabet is q — p . 

Let be an orthogonal array of length \A\j\ over the alphabet Z p . We will specify a concrete 
choice in a moment. From QjJ, we define T M in (jllj) by requiring that the ith components of the 
elements in the sequence satisfy Q\.j- The sets Xm are defined as in JTTJ). We additionally define 

X® = {xe1 n p \ x Am e Q^}, 

M 

for i < t(M), and X$ = Z™ otherwise. Note that X M = lf i=1 X$ in the sense that, for each sequence 
a;W g Xj$ with i = l,...,£, there is a corresponding element x € Xm with Xj = {x^\ ■ ■ ■ , xp). 

Now we make our choice for Qm- Let U C Z p be a set with small Fourier bias and some S = \U\/p 

that exists due to Theorem [19] We define as consisting of all x G Zp M such that the sum of the 
elements of x belongs to U. With this definition, 

\X$\ = 5p n . (24) 
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Hence, there are exactly Sq n elements x <E Z n such that x.(i> <G T^'. If we let S = 1/(2£\C\), a calculation 

similar to (f22j) shows that |V| > q n /2. Also, by considering each i G [£} independently, it is easy to see 
that all Xm satisfy the orthogonality condition. Thus, Lemma [T71 applies, and (jTSJ) holds. 

Now it remains to estimate ||r'||, and it is done by considering matrix V as described in Section I5T21 
and performed once in Section 15.41 If T' = 0, then also V = 0, and we are done. Thus, we further 
assume T' ^ 0. Recall that {xa)aei v denotes the Fourier basis of Z p . The basis e is defined as the 
Fourier basis of C z . It consists of the elements of the form e a = ® j=1 x a <;> where a = (a^) G Z. Note 
that eo has the required value, where is interpreted as the neutral element of Z. 

If v = (Vj) = {vf) E Z n , we define e„ = ®" =1 e^., and G Z™ as {v[ l) , . . . , v$). Also, for 
w = (wj) G Z™, we define = ®" =1 ■ 

Fix an arbitrary M € C. Let B M = {G' M 

\\Bm — Bm\ 

because this implies 

||(f')*r' - (f'yf'w = II (Bm - b m ) I < Y, \\Bm - b m \\ -> o 



' M )*G' M and -Bm = {G' M )*G' M . We aim to show that 



as p 



oo, 



(25) 



A/ec 



as p — > oo. As ||r'|| > 0, this implies that ||r'|| < 2||r'|| for p large enough, and together with (fT9)l and 
Theorem [151 this implies Theorem [21 

From (|20)) . we conclude that the eigenbasis of Bm consists of the vectors e v , with v G Z n , defined 
above. In order to understand Bm better, we have to understand how e.„pA/] behave. We have 



(26) 



Hence, it suffices to understand the behaviour of For w G Z™, A C [n] and c G Z p , we write 

w + cA for the sequence w' G Z™ defined by 



w ,- 



Wo 



Wo 



c, j G A; 
otherwise. 



In this case, we say that w and w' are obtained from each other by a shift on A. 

Claim 20. Assume w,w' € Z£, and let £ = (x44?])*fc'K/l)- V w = w ' > then € = S - V w + w> > 
but w can be obtained from w' by a shift on A^J , then |£| < \\U\\ U . Finally, if w cannot be obtained from 
w' by a shift on A^, then £ = 0. 

Proof. Arbitrary enumerate the elements of U — {ui, . . . ,u m } where m = Sp. Denote, for the sake of 
brevity, A — A^J . Consider the decomposition Xj$ = UfeLi Xk\ where 



x k = {we Z™ | J2 jeA 



Wj = u k 



Fix an arbitrary element a G A and denote w = w — w a A and w' — w' — w' a A. In both of them, 
w a = w' a — 0, and by an argument similar to Claim [TBI we get that 



l/p, w — w'; 



0. 



otherwise. 



(27) 



If x E Xfe, then 

n 



: exp 



i=i 



27TI \ - 



1 



: exp 



2?ri / 
p V 



^ w 3 x i 



w a 2^ Xj 



) =exp( 



27ri w a ii fc \ 



P 
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Hence, 



k=l fc=l 

If w' cannot be obtained from w by a shift on A, then w ^ w 1 and ([25)1 equals zero by ([2"T]) . If w = w', 
then (|28[) equals m/p = <5. Finally, if w' can be obtained from w by a shift on A but w ^ w' , then w — w' 
and w a 7^ u/. By (|2"T1) and (|2"3"]) . we get that ([25)1 does not exceed \\U\\ U in absolute value. □ 

Let v € Z n , and S = {j £ [n] | v 3 ^ 0}. Let v' £ Z", and define 5" similarly. By (|T5 |) . PU|) . 
and (|26p . we have 

, g g n Ps{M)p sl {M) i fi s {M)(3 s ,{M) J* ry (i) lv ., ry «)ix 

e v B M e v > = — (e4A M J) (e</lA M J) = Tl M (x v ^ I x m J) (Xv'^\ x m\)- 

|A M | ° fJi 

(29) 

By this and Claim [501 we have that 

e* v B M e v = ps{Mf = e* v B M e v . (30) 

Call v and v' equivalent, if (3s(M) and (3s>(M) are both non-zero and, for each i £ [£], t>W can be 
obtained from by a shift on ^4^. By (12U1) and Claim [2lH we have that e* v Bu&v' is non-zero only if 
u and i/ are equivalent. 

For each is [£], there are at most \A^J \ < n shifts of on that have an element with an index 
in A^ equal to 0. By (p?c]) . the latter is a necessary condition for /3s(M) being non-zero. Hence, for each 
v € Z n , there are at most elements of Z n equivalent to it. 

Thus, in the basis of e v s, the matrix Bm has the following properties. By ((30)) . its diagonal entries 
equal the diagonal entries of Bm, and the latter matrix is diagonal. Next, Bm is block-diagonal with 
the blocks of size at most n . By ([29]) and Claim l20l the off-diagonal elements satisfy 

\e* v B M e v/ \ < &fo(M)/9 S '(M), 

because \\U\\ n < S. Since the values of /3s (M) do not depend on p, and by Theorem \T§[ the off-diagonal 
elements of Bm tend to zero as p tends to infinity. Since the sizes of the blocks also do not depend on 
p, the norm of Bm — Bm also tends to 0, as required in (1231) . This finishes the proof of Theorem [5] 
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